Security and data
Where your data lives and what we never do with it
Counter Club holds your shop's details, your members' mobile numbers and a count of stamps. That is sensitive enough to deserve a plain account of where it sits, who handles it, and the things the product refuses to do.
Hosting
The application runs on Vercel in Sydney and the database on Supabase in Sydney, with daily backups. Your members' data stays in Australia except where a provider below processes a message to deliver it.
Payments
Card details never touch Counter Club. Paid plans are set up on a Stripe Checkout page and card changes use Stripe-hosted card entry inside Billing. We hold a reference to your customer record at Stripe and the status of your subscription, nothing more.
Texts and numbers
Verification codes and campaign texts are sent through Vonage, which also supplies the sending number that comes with Local Favourite. A text may be routed outside Australia on its way to the handset. STOP replies to your number come back through the same provider and are acted on at once.
Welcome emails, sign-in links, member email confirmations and email campaigns go through Postmark. Postmark may process a message outside Australia to deliver it.
Consent handling
A member's consent is the texted code they confirmed on the join page. An email address is used only after the member confirms it from a link. Opting out is one press or one STOP reply and is recorded against the member at once. The Free plan's marketing consent is recorded with the exact sentence shown, the time, and the address it came from, and its withdrawal is recorded the same way.
Sign-in
Your password has to be ten characters or more, and only a hash of it is ever stored. You can sign in by password or by a link emailed to you. Changing your password signs out every other device and emails your confirmed address. We never email a password.
What the product never does
It never lets an owner add a member by hand. It never texts a number that did not confirm a code. It never lets one shop see or message another shop's members. It never sells or shares member data for marketing. And it never touches your listing on Not a Chain: no rank, no badge, no claim.
- No hand-added members
- No texts to unverified numbers
- No cross-shop access
- No sale of member data
- No effect on the directory
Reporting a problem
If you find a security problem, email hello@notachain.com.au with what you found. A person answers within one business day on Melbourne time, and we would rather hear it from you than anyone else.